froq-create-repo

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (medium risk: 0.30). The skill instructs generated repos to run reusable GitHub Actions workflows from sxzz/workflows at the mutable @v1 tag, so remote workflow code executes in CI; that individual-owned repository is not first-party and the tag is not immutable, making it a common/reputable unofficial dependency (medium).